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Abstract 

In this paper, we gave a preliminary dynamical analysis on the RSA 
cryptosystem and obtained a computational formulae of the number 
of the fixed points of k order of the RSA. Thus, the problem in [8, 9] 
has been solved. 
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1 Introduction 

Shortly after Diffie and Hellman [1] introduced the idea of public key cryp- 
tography, Rivest, Shamir and Adleman (RSA) [2] proposed such a cryp- 
tosystem. A simplified version of RSA is the following: 

Let n = pq be the product of two large primes of the same size. Let e, d 
be two integers satisfying ed = 1( mod <p(n)). Call n the RSA modulus, 
e the encryption exponent, and d the decryption exponent. Let e and n 
be public keys, and let d be the corresponding secret key. A message is 
an integer m G Z n . To encrypt m, one computes m e = c( mod n). To 
decrypt the ciphertext c, the receiver computes m = m ed = c d ( mod n). 
Denote such a cryptosystem by RSA(n,e). We call m a fixed point of 
RSA(n,e) if m e = m( mod n). And call m a fixed point of order k if 
k is the smallest positive integer such that m e = m( mod n). Clearly, 
/ : x — ► x e { mod n) is a dynamical system. Thus, k is exactly the period 
of m. For more details on the arithmetic of dynamical systems, see [7]. 
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In 1979, Blakley and Borosh [3] first pointed out that there were at least 
9 fixed points in RSA(n,e). For more references on fixed points, also see 
[4]- [6]. Denoted the set of all fixed points of order k of RSA(n, e) by E n ^ e ^ 
and the cardinality of the set S by | S |. In [8, 9], Yu considered the general 
case of fixed points of order k and gave geometric mean value of |T„ je) fc| and 
pointed out that it was difficult to give a quantitative description of |T„ iei fc|, 
where A; is a given positive integer and 

T n: e,k = {%\ Vm < k, m G N, x G Z*, x e = x{ modn),x e / x{ mod n)}. 

In this essay, we preliminarily consider this question and obtain the 
following results: 

Theorem 1 \T n ^ k \ = [i(k/d)(e d - l,p - l)(e d - 1, q - 1) , where //(•) 
is the Mobius function. 

Based on this result, we get Theorem 2. 

Theorem 2 \E n>e>k \ = ^/d){{e d - l,p - 1) + l)((e d - 1, q - 1) + 1). 

2 Proof of Main Theorems 

We denote the set of positive integers by N . For given positive integers a 
and b, we write a\b if a divides b . And denote the greatest common divisor of 
a and b by (a, b). Denote a complete set of residues modulo n by Z n , where 
1 < n G N , and a reduced set of residues modulo n is denoted by Z*. Let 
a be an integer relatively prime to n. The order of a modulo n, denoted by 
ord n (a), which is the smallest positive integer d such that a d = 1( mod n). 

Lemma 1[8] For 1 < n G N, r G N, let the canonical factorization of 

m 

n be FJ and T n<r = {x\x r = 1( mod n), 1 < x < n}, then \T n>r \ = 
i=i 

m 

i=i 

k 

Lemma 2 For l<n£N,a,m,k£N,e£ ^( n )' ^ ° e = a ( mo( i n ) an< ^ 
/c|m, then a 6 " 1 = a( mod n). 

Proof Let m = tk. When t = 1, clearly a 6 * = a 6 ™ = a( mod n). Suppose 
that a e ™ = a( mod n) when t = I. And when t = Z + 1, we have a 6 ™ = 

Ik k k 

a e e = a e = a( mod n). It immediately shows that Lemma 2 is true by 
induction. 

Lemma 3 For 1 < n G N, a, m, k G N, e G ^( n )> if = a ( mod n) and 
a G -En.e^) then fe|m. 
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Proof Let m = kt + r,teN,0<r<k. We have of 1 = a e t&r = of = a( 
mod n) by Lemma 2. Since a G -En,e,fc) hence r = 0, and Lemma 3 is true. 

Proof of Theorem 1 By Lemma 1 and Lemma 3, it is easy to deduce 

m 

Sdlfc l^n,e,d| = II (e k — 1, <p(p®')). By Mobius inversion, it immediately shows 
i=i 

that Theorem 1 is true. 

Proof of Theorem 2 By Lemma 2 and Lemma 3, analogously, using 
Chinese Remainder Theorem and the method of proof of Theorem 1, it is 
easy to deduce that Theorem 2 is true. 

Corollary 1 Let 1 < n G N, r G N, and let the canonical factorization of n 

m m 

be n PT- Then \{x\ord n (x) = r,l<x£Z*}\ = £ d , r (Mr/d) ft (d, v(j>?)))- 

z=l i=l 

Corollary 2 Let 1 < n G iV, r G iV, let the canonical factorization of n be 

m 

n and let F n>r = {x\Mk < r, k G N, 1 < x < n, x r = x{ mod n),x k / 
i=i 

m 

x( modn)}. Then |F n>r | = Zd\M r /^ U i 1 + ( d ~ ^ *>(??))))■ 

i=l 

3 Conclusion 

Clearly, if the factorization of n is known, then computing the number of the 
fixed points of order k of the RSA cryptosystem is simple and convenient 
by the presented formulae. This is useful to pick the encryption exponent, 
which is necessary to ensure the resulting RSA safe from fixed points attack. 
Maybe we are not afraid of a fixed point. However, the following problem 
should be further considered: Is there a polynomial-time algorithm for find- 
ing a fixed point m, where ±1? This problem and Factoring the RSA 
modulus perhaps are equivalent. 

Remark: This paper is the revision of paper [10] in the proceedings of 
China Crypt'2006, whose Chinese version has been accepted by Journal of 
Mathematics (Wuhan, China). 
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